Confidential AI Network
Governed multi-party training without a central data lake
High-value models often need data that cannot be freely centralized. Confidential AI Network (CAN) explores a control model where providers, consumers, and clean-room operators negotiate a machine-enforceable contract, train only in policy-bound environments, and retain provenance for verification.
Executive overview (CISO) Ricardian contracts CAN: contract to prediction Product tour
Problem
Healthcare, finance, public sector, and industrial organizations hold data that cannot be freely exported. Model builders need that data, but a shared central lake concentrates sovereignty, liability, and competitive risk.
CAN treats collaboration as a protocol: catalog metadata → Ricardian contract → signed, policy-bound training → provenance on a confidential ledger. Informed by India’s iSPIRT DEPA (Data Empowerment and Protection Architecture); intended to run on enterprise clouds with native IdPs.
Design objectives
- Data remains with its owner. TDPs publish catalogs and use policies; access is use-bound and time-bound.
- Training runs where policy allows. TSP / CCRP environments (TEE, private cloud, or attested Kubernetes).
- Steps are attributable. Signatures, job outcomes, and claims toward SCITT CCF for GRC evidence.
- Split identity planes. Humans via cloud IdP (Entra, OCI IAM, Identity Platform, Cognito); workloads via SPIFFE/SPIRE and cloud workload identity.
Architecture at a glance
One control surface, three trust planes: people, cloud APIs, and peer workloads. Contracts bind the commercial agreement; confidential compute and cryptography enforce the technical one.
Shared control objectives across Azure, AWS, GCP, and OCI: Multi-cloud security architecture patterns.
┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ TDP │ │ TDC │ │ TSP/CCRP │
│ datasets │ │ models │ │ clean rooms │
└──────┬──────┘ └──────┬──────┘ └──────┬──────┘
│ │ │
└─────────┬─────────┴─────────┬─────────┘
▼ ▼
┌─────────────────────────────────────┐
│ Portal + APIs · Ricardian terms │
│ Cloud identity provider SSO · roles│
└──────────────────┬──────────────────┘
▼
┌─────────────────────────────────────┐
│ Contract lifecycle → training jobs │
│ DEK/MEK · DP options · provenance │
└──────────┬───────────────┬──────────┘
▼ ▼
┌────────────────┐ ┌─────────────────┐
│ Isolated train │ │ SCITT CCF ledger│
│ TEE / K8s / VM │ │ claims & audit │
└────────────────┘ └─────────────────┘
Control plane
Portal, APIs, contract state machine, catalog, AppAdmin; cloud IdP for humans.
Data & crypto plane
Dataset encryption, key escrow, optional DP, DEPA-aligned entity IDs.
Execution plane
Policy-bound training; SPIFFE/SPIRE for east-west where enabled.
Evidence plane
SCITT CCF claims; SIEM export for SOC workflows.
Start here
Product tour (Local path) · Azure confidential computing (threat model · Key Vault · SKR).
Notes & whitepapers
Long-form specs live in the repository docs/ tree; this site is the short path.
Start here
Executive overview
Executive path — start here before specialist notes.
- Contract management in CAN — party signing keys, sign gates, and verification
- Ricardian contracts in CAN — legal prose the runtime can enforce
- Azure product tour deck — Entra to governed prediction
- Confidential AI Network: from signed contract to governed prediction
- Governed AI for the enterprise — a CISO’s overview
- Product tour
- Try it: CAN ↔ Open-GMASE ↔ CompliancePulse (demo slice)
Specialist notes
Platform — Confidential AI Network
Product and architecture detail for CAN.
KMS, TEE & provenance
Keys, clean-room decrypt gates, and tamper-evident audit when models misbehave.
Agent governance — G-MASE & CompliancePulse
For security architects and platform engineers.
Architecture essays
Adjacent notes on protocols and agentic systems (not CAN product docs).
Identity — humans, cloud APIs, workloads
Zero-trust identity for people and for agent fleets on Kubernetes.
- Three identity planes: humans, cloud APIs, and workloads
- SPIFFE/SPIRE with Azure — AKS Workload Identity and Entra federation
- SPIFFE/SPIRE with OCI IAM workload identity
- The credential every AI agent fleet on an OKE node ends up sharing
- Beyond instance principals: fixing the pod identity gap in OKE
- Short take: per-node credentials break multi-agent fleets on OKE
Cloud security architectures
Deployment-shaped notes for cloud identity and edge controls.
Compliance & documentation map
Where reviewers find controls evidence and how requirements map to NIST, CIS, and OWASP (incl. LLM).
All posts by date
Newest first.
- Is India’s OCEN protocol the missing blueprint for agentic AI workflows?
- Azure confidential computing for CAN — threat model, Key Vault, Secure Key Release, and e2e training
- Contract management in CAN — party signing keys, sign gates, and verification
- SPIFFE/SPIRE with Azure — AKS Workload Identity and Entra federation
- Azure product tour deck — Entra to governed prediction
- KMS for Confidential AI Network — DEK, MEK, and dual-key escrow
- TEE training in CAN — attest the enclave, verify the contract, then decrypt
- Merkle trees for model audit — proving what happened when the model misbehaves
- Ricardian contracts in CAN — legal prose that the runtime can enforce
- Confidential AI Network — contract to prediction (moved)
- Confidential AI Network: from signed contract to governed prediction
- Try it: CAN ↔ Open-GMASE ↔ CompliancePulse (demo slice)
- CompliancePulse AI deep dive: zero-trust control plane for agent execution
- G-MASE deep dive: Governed Multi-Agent SecOps Environment
- Governed AI for the enterprise — a CISO’s overview
- Unified Governed Agentic SecOps Framework
- Governing autonomous AI agents in cybersecurity operations
- Beyond instance principals: fixing the pod identity gap in OKE
- Building Confidential AI Network — governed multi-party training without a data lake
- The credential every AI agent fleet on an OKE node ends up sharing (and shouldn't)
- Short take: per-node credentials break multi-agent fleets on OKE
- Azure security architecture — Entra-only identity on cloud
- Requirements met — NIST, CIS & OWASP (incl. LLM) mapping
- Where to find CAN security docs (map for reviewers)
- SPIFFE/SPIRE with OCI IAM workload identity — scaffolding what we ship
- Three identity planes: humans, cloud APIs, and workloads